
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
require-env-var
Advanced tools
Our projects are litered with environment variables. If we're doing things correctly, we're using a .env
file and not checking it into source control. We're probably also using something along the lines of .env.example
to track what variables should be set in our .env
.
This may be fine when working solo or on a small team, but with larger projects it's easy to miss changes to .env.example
. Furthermore, undefined environment variables don't always present themselves in the most obvious of ways.
require-env-var
is a small library that helps with that. It allows you to specify which environment variables are required, and if they don't exist you get an error message telling you what key is missing. Additionally, it provides support for specifying multiple keys (first one wins) as well as a fallback in case no keys are found.
Install using yarn
:
yarn add require-env-var
Install using npm
:
npm install --save require-env-var
require-env-var
exposes a single function:
const requireEnvVar = require('require-env-var');
const port = requireEnvVar('PORT');
You can also use ES6-style imports if you'd like:
import requireEnvVar from 'require-env-var';
const clientId = requireEnvVar('CLIENT_ID');
You can provide an array of keys and require-env-var
will return the first one that is set:
const port = requireEnvVar(['SERVER_PORT', 'PORT']);
If none of the keys provided exist, require-env-var
will throw an error:
Required environment variable [SERVER_PORT or PORT] is not set!
However, if you specify a fallback, that will be returned instead:
const port = requireEnvVar(['SERVER_PORT', 'PORT'], '8080');
console.log(port) // Suprise, it's `8080`!
MIT
FAQs
Easily require environment variables or else
The npm package require-env-var receives a total of 509 weekly downloads. As such, require-env-var popularity was classified as not popular.
We found that require-env-var demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.